Duplicate Project Name and Version when Cloning and Uploading BOM File

[eugenhoffmann]

Current Behavior

We have observed a race condition that leads to duplicate project names and versions in Dependency-Track when triggering a project clone and immediately uploading the BOM file to the project clone without waiting for the clone to complete.

Note: The issue was not observed in Dependency-Track version 4.11

Steps to Reproduce

1. Trigger a project clone using the API "api/v1/project/clone" without awaiting the completion
2. Immediately upload the BOM file with the "auto-create" parameter to the project clone using the API "api/v1/bom", specifying the same project name and version.
3. Observe the projects in Dependency-Track and verify that a duplicate project name and version is created.

Expected Behavior

A single project with a unique name and version should exist in Dependency-Track.
The BOM upload should fail or the system should wait until the clone process is complete before uploading the BOM file in Dependency-Track

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15.8

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

In v4.11, project cloning was not an atomic operation. This means that the new project version was visible to other processes way sooner than it is now (assuming READ COMMITTED isolation level).

Unfortunately we can't use a unique constraint on NAME andVERSION in the database, because version can be NULL. In some databases, unique constraints allow multiple NULL values.

Working around this is possible using partial indexes, but the ORM we use doesn't support (i.e. cannot create) those.

For completeness, we were able to apply such partial indexes in v5.x, where we can focus on PostgreSQL: https://github.com/DependencyTrack/hyades-apiserver/blob/cdfd62d4a0ba0b96d66ca9910ce6226710488ca2/src/main/resources/migration/changelog-v5.4.0.xml#L17

Not sure what we can do to prevent this without help from the database, outside of maybe acquiring a lock before creating a project.